Anthropic VS Code Extension on Cursor Backdoored for Nearly 12 Hours

The Anthropic VS Code extension distributed via the Cursor marketplace was compromised with a backdoor that persisted for nearly 12 hours before being detected and removed. This represents a direct supply-chain attack on the AI-integrated developer toolchain, affecting any developer who had the extension installed during that window. The incident highlights the growing security risks as AI tooling becomes deeply embedded in coding environments, where malicious code can have direct access to codebases, credentials, and API keys. Developers using Cursor or any AI-integrated IDE should audit installed extensions, rotate any secrets that may have been exposed, and review their extension update policies. This is a significant wake-up call for the ecosystem as IDE-level AI integrations multiply rapidly.